CAMGETPASSTHRU can spin forever holding the SIM lock (privileged local DoS)

Summary

CAMGETPASSTHRU handler uses two nested loops: inner while(status==CAM_GDEVLIST_MORE_DEVS) outer while(found==0). Outer loop only exits when status==CAM_GDEVLIST_LAST_DEVICE or pass periph matched. If xpt_action returns CAM_GDEVLIST_ERROR or CAM_GDEVLIST_LIST_CHANGED on every iteration (happens when device periph list empty/mutated concurrently) outer loop spins forever. Every caller of cam_periph_ioctl (scsi_pass scsi_cd scsi_ch scsi_sa scsi_pt scsi_ses) holds cam_periph_lock (SIM lock) across the call so spin wedges all I/O on that SIM not just calling device. Local DoS requiring SYSCAP_RESTRICTEDROOT plus concurrent operation mutating periph list (bus rescan USB unplug devd rescan). Most reliable trigger: LUN whose last periph detached between index increments xpt returns ERROR outer while never exits. [VERIFIED pass2: reproduced on real code - empty periph list spins forever with SIM-lock NOWAIT probe EBUSY on all 60 watchdog samples; practical trigger needs sustained churn, honest caveat recorded; terminate-plus-bound fix-validated ioctl returns]